Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
Android Handhelds Privacy

Factory Reset On Millions of Android Devices Doesn't Wipe Storage 92

Bismillah writes: Ross Anderson and Laurent Simon of Cambridge University studied a range of Android devices and found that even though a "factory reset" is supposed to fully wipe storage, it often doesn't. Interestingly enough, full-device encryption could be compromised by the incomplete wiping too. ITnews reports: "The researchers estimated that 500 million Android devices may not fully wipe device disk partitions. As many as 630 million phones may not wipe internal SD cards. Five 'critical failures' were outlined in the researchers' Security Analysis of Android Factory Resets paper.
This discussion has been archived. No new comments can be posted.

Factory Reset On Millions of Android Devices Doesn't Wipe Storage

Comments Filter:
  • by Anonymous Coward

    That's why you use encrypted storage.

    If you aren't able to use encrypted storage, then you destroy the device.

    • by Anonymous Coward

      " Interestingly enough, full-device encryption could be compromised by the incomplete wiping too. "

      • by Anonymous Coward on Friday May 22, 2015 @07:55AM (#49749659)

        No shit, you can get the encrypted data if it isn't wiped.

        If the "encrypted" data can still be compromised, then it isn't truly encrypted, so encrypted storage isn't being used, and thus the "destroy the device" part applies.

        Truly encrypted data is indistinguishable from random data to an attacker. In fact, that's even better than a reset device's storage being zeroed or oned out, since it doesn't indicate that the device had been obviously reset.

        Besides, the summary is wrong. If you actually read the article, it says (emphasis added)

        For Android users wanting to ensure their data is completely wiped from their device, the researchers suggested turning on full-disk encryption where it is offered

        • by ledow ( 319597 ) on Friday May 22, 2015 @08:20AM (#49749751) Homepage

          Indeed - the whole point of full-disk encryption is that "reset" really consists of "zero the place where the master key was stored, which was encrypted by the user passphrase".

          Do that, and do that effectively, and you don't have to touch ANYTHING else - it all becomes random gibberish without a valid key. It could literally mean just keeping a couple of hundred bytes of RAM in an EEPROM and then destroying it on "factory reset".

          For convenience of detection, however, you may want to zero the first few sectors of the storage so that filesystem probes see it as "no filesystem" rather than as random gibberish. But that's got zero impact on the data that WAS within it.

          There's a reason that everything before 4.4 was third-party encryption and untrusted. There's a reason that proper, system-level full storage encryption (including SD card encryption) required changes to the OS. Since then, however, you just need to make sure nobody has your passphrase to stop them getting into your device. Then make sure that nobody has the passphrase-encrypted key blocks at the beginning of the disk (usually) and the data is nothing more than random gibberish.

          About the only thing needing a complete wipe of all data is really if you're put into duress to provide a key (which would obviously then provide the data) or if a key is discovered and someone wishes to prove that you DID hold the key / data (by provably decrypting with that key to show that it must have been the right one and, maybe, therefore that you had knowledge of it).

          Wipe the key-block, and the encrypted data is basically undecryptable. Same way TrueCrypt etc. work. And even though your passphrase may only be 10 characters, the key block might well be hundreds of bytes long and THAT's what actually has to be decrypted first in order to get the real key to decrypt the rest of the data.

          • by mlts ( 1038732 ) on Friday May 22, 2015 @10:53AM (#49751049)

            The Windows format command does this. If one uses it on a BitLocker encrypted volume, it will go and zero the parts on the volume that hold the BitLocker master key, so even if someone later has a recovery password, the data is still completely gone. Same with secure erase on a number of SSDs.

            Since Android is sitting on a SSD, it might be wise to move to a smarter wiping system. One that would wipe the dm-crypt data, core places of the filesystem, and after that, TRIM the entire data partition before formatting and rebuilding it. The TRIM command helps ensure that the data present isn't recoverable at the drive level, and likely will get utterly destroyed when the drive erases the TRIMmed pages.

            I read about some newer phones using a chip to store the encryption key for /data, similar to how iOS does it, but when hardware starts getting involved, it becomes harder to deal with a potential backdoor.

            Maybe the ideal is a small bit of storage that is used, and if it is erased, the erasure is guarenteed (where there is no way to recover previously stored data.) Then, the master key is stored there. On initial bootup, the phone prompts the user for the PIN, decrypts the key stored on that small bit of storage for the master key to /data, and proceeds from there. On an erase, /data gets force unmounted, the small storage is erased, and a blkdiscard is issued for the /data's device. Not 100%, but it will pretty much ensure anything stashed in /data is gone.

            Then there is the external SD card. Unlike /data, there isn't a real standard to encrypt that storage partition. Usually it winds up being encrypted on a file by file basis with some EncFS offshot. The key for this is stored in /data, so if the phone is wiped, there isn't any way to retrieve the SD card's data. What might be an idea would be to offer the file based mechanism, but also offer the ability to format the SD card and encrypt the entire card on a device level, not just on a file by file basis.

            Of course, something like phonebookfs could be used so that someone looking at the encrypted file stash on the SD card can't tell between real data and randomly generated chaff, but that may not be something for mainstream phones.

  • by brunes69 ( 86786 ) <slashdot.keirstead@org> on Friday May 22, 2015 @07:43AM (#49749629) Homepage

    "fragile full-disk encryption up to Android v4.4 (KitKat)."

    "Twenty-six second-hand Android phones running versions 2.3 to 4.3 of the operating system, sold by five handset makers, were tested."

    This paper did not look at Android 4.4 or above, IE, the only versions of Android that actually properly supported and advertised full disk encryption in the first place. Full disk encryption on any device prior to 4.4 was basically something the manufacturer cooked up.

    If this paper shows anything to me, it is not so much about Android, it is more about how we have to force carriers to stop requiring this goddamn nonsense useless "carrier certification" so that Google can push device manufacturers to allow more direct and timely software updates.

    • Doesn't change much unless full disk encryption is enabled by default. In most cases it isn't. It still relies on a user doing something they typically won't do.

      The real problem is that factory reset functions in the bootloader don't actually factory reset the phones. Factory reset means one thing and one thing only, a clean slate. There should be no scenario at all where a factory reset will preserve user data. Give the user the option to do a different form of reset, but don't ever preserve data and "clai

    • by gstoddart ( 321705 ) on Friday May 22, 2015 @08:19AM (#49749747) Homepage

      Yes, and how many of those devices are supposed to support the factory reset which wipes all the storage?

      What's that? All of them?

      Full disk encryption is one of 5 problems they found, but not the main one.

      the researchers found that all retained at least partial amounts of data from contacts information, images and video, SMS, email, and data from third-party apps like Facebook.

      They were able to recover Google authentication tokens in all devices with flawed factory reset, and were able to access master tokens in 80 percent of cases.

      To test their findings, they used one of the recovered master tokens from a reset to restore the credential file.

      Disk encryption, in theory, should make the factory reset more robust. But the sense I get is that the factory reset is complete garbage independent of encryption on some of these devices.

      Which mostly reaffirms that I have no interest in anything but the stock Google Android. Because by the time another entity has gotten their hands on it and tweaked it to advance their own commercial interests , you really have no idea of what holes they've introduced, and you have no idea how long before they'll drop support for it.

      Carrier certification is shorthand for "all of our crapware needs to be checked if we get around it". The shit carriers put on phones is for their benefit, not ours. Because it's intended to drive traffic to their garbage.

    • by jandrese ( 485 )
      So the lesson is that if you have a pre-Android 4.3 phone, you definitely need to upgrade it to 4.4 or later. No problem.
      • by caseih ( 160668 )

        Meh. Android 4.4 broke SD cards completely. My phone runs android 4.2, and it works, so I don't want to mess with it. I think that's how a lot of people are, despite security bug risks. I like Android in general but there's a lot I don't like. One of them is that updates are dependent on the vendor. The other is the murky world of semi-legal firmware distributions that rely on crappy forums for developer interaction with no public version control, no nice spots for download. Who knows what's in Joe's f

        • by mlts ( 1038732 )

          The good news is that there are apps (which require root) which will modify SELinux so that the SD card is usable. Since most SD cards are using FAT32, there isn't any real way to enforce permissions, so for security reasons, the card wound up being locked from most apps completely.

          Of course, it would be nice if the SD card could be formatted with ext4, so permissions could be enforced.

          Another option, which was part of Linux, but pulled out a long time ago, was the UMSDOS filesystem. What this did was put

          • by jandrese ( 485 )
            Why can't Android devices mount EXT4 formatted SD cards? Or better yet, format them if they're FAT32? Granted you won't be able to plug your SD card into your camera or Windows box, but I don't think that's a common use case for cards stuffed in phones.
            • On early phones, taking the SD card out of your phone and putting it in your computer was a common use case. It was usually a much faster way to get files onto it than tethering the phone by USB was. And those old phones had card slots that were right on the side of the device so the card was easy to remove and replace.

              I remember doing that for my first smartphone (Sprint Evo 4G); the SD card was a pain to get to (you had to take off the back cover and remove the battery) but the phone's SD data transfer wa

              • Side slots suck because people tend to forget to unmount the card, with data integrity issues as a result. With the card behind the battery this is not an issue.

      • What's the definition for abuse? Keep coming back because the next time, it'll be better, I promise!

    • While it is not so much about Android, it is bout Google. Apple managed to keep carriers out of their phones all together. Google could have as well, but they didn't. Everyone knew what a mess carriers were even back then (buy a ringtone from us for $4.99!), but Google went along with it.

    • If this paper shows anything to me, it is not so much about Android, it is more about how we have to force carriers to stop requiring this goddamn nonsense useless "carrier certification" so that Google can push device manufacturers to allow more direct and timely software updates.

      This is basically the reason the new phone I got it not Android. They have a long track record of not being able to get updates onto phones. It is simply unacceptable to not receive any updates on a phone that I paid good money f

  • The analysis paper starts out by saying "With hundreds of millions of devices expected to be traded by 2018, flaws...could be a serious problem." Unfortunately that same analysis focused on Android operating systems PRIOR to v4.4 (KitKat), which was released in October 2013 (https://en.wikipedia.org/wiki/Android_version_history).

    Since then, Android has released major versions (4.4 Kitkat, 5.0 Lollipop) and various major updates within those families (4.4.2, 4.4.4, 5.1). To put this in perspective, they're

    • My guess is this isn't a case of cherry-picking, it's just that it took them 2-3 years to complete and publish the research. I wouldn't think it takes that long to acquire and study 21 phones, but looking at some of the dates in their paper, maybe it took *them* that long.

      I don't think of this as ground-breaking research, it's more like archaeology. Better editorial surrounding the research could have been done in a "See how far we've come since 2013" type of way.

    • It sounds to me as though you think nobody is affected by this. The study refers to phones that are already in service and at an age where many people are considering trading up to newer devices -- potentially falling victim to a huge privacy and security issue. I have an Android device right beside me that falls into this category. It never occured to me -- until now -- that the factory reset function could potentially fail to sanitize its data storage. T-Mobile is my carrier and there have been exactl

      • I'll remember this when selling my device which I store TS-SCI rated data on.

        FTFA, "Individuals buying devices on auction websites such as
        eBay are possible attackers. They need to spend a nonnegligible
        time to bid and follow up on auctions. Furthermore,
        they have to pay a few dollars for commission
        and shipping fees for each device. So low-value data
        like contacts and email addresses do not seem profitable.
        Recovery and analysis of conversations and images (to
        blackmail victims) would generally require human inte

    • by thegarbz ( 1787294 ) on Friday May 22, 2015 @08:24AM (#49749767)

      Since then, Android has released major versions (4.4 Kitkat, 5.0 Lollipop) and various major updates within those families (4.4.2, 4.4.4, 5.1). To put this in perspective, they're talking about risks in 2018 from software no newer than 2013 while writing and publishing in 2015.

      More than half of current devices in the hands of people have the versions which they tested.

      There were many fixes in Android security systems in 4.4 and also in 5.0.

      Which has nothing to do with factory reset, a function implemented by the manufacturer and not a function of Android itself. Unless the manufacturers have picked up on it, 5.0 devices are just as likely to preserve user data as previous devices.

      5.0 now supports hardware encryption on e.g. HTC and OnePlusOne platforms among others.

      Supports means nothing. No actually it means a lot. Hardware encryption is currently supported by a tiny TINY portion of the handsets out there. But here's a fun fact for you, supported doesn't mean the end user will use it. 5.0 does not mandate encryption by default. It's not an opt out process. I don't even need to guess how many users went out of their way to turn this feature on.

      but in this case the hype cherry-picks data that ignores two years of active open-source development and many security updates

      All which mean diddleysquat in practical terms if the updates haven't filtered down to the population, and the updates mandate proper security practices. Neither of which has occurred in the past 2 years.

  • by DigiShaman ( 671371 ) on Friday May 22, 2015 @08:04AM (#49749689) Homepage

    See, this is why I'm a convert to Apple iOS. Yes, there are a few reputable hardware vendors for Android like Samsung and LG; and in many cases, superior hardware specs for the latest device. The problem is the hardware/software permutation and lack of post-sales support and upgrades. THIS is why I abhor the Android platform. Yes, it's open source, but it's also chaotic in quality control when comparing and contrasting between not just vendors, but the year in which the vendor brought to market! Love it or hate it, Android is pretty much anarchy wild-wild-west while Apple is, well, Apple.

    I can only speak for myself, but I like consistent, stable, and well throughout platforms; even if that renders me very little control. It all comes down to trust. Burn my trust, and I walk.

    • by jones_supa ( 887896 ) on Friday May 22, 2015 @08:12AM (#49749713)
      I know exactly what you mean, but I actually like the wild west of PC and Android. Lots of interesting devices to pick from, and low prices. It's more fun.
      • by mlts ( 1038732 )

        I like Android's customizability and the ability to replace things. For example, I toss the launcher and go with Nova's. The keyboard app gets replaced, and I use a custom texting app that supports encryption.

        Plus, I have more privacy on Android with XPrivacy. For example, a lot of apps pull your ad info, IMEI, hardware serial number, and anything they can find for behavioral tracking. With XPrivacy, the app will happily get a number... but it will be a random one. I can also ad block on the IP level.

      • The nice thing about PCs is that you can update the software yourself. I like the selection that you get with Android, but 99.9% of the handsets are a terrible choice. When I get a laptop or desktop, I can put Windows, Linux, or even BSD on it if I want to, and nobody tries to stop me. I can update the software whenever I want. I've been running the same desktop for 9 years, and it still works fine because I control the software that runs on it.

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      I don't understand your logic. If for example, Samsung and LG make decent Android devices and provide support for them, you could buy from them and get a decent consistant Android device and support. Your logic implies you will avoid the whole platform because somehow a chinese company Hawichezza can make a crappy Android device and that makes Samsung and LG products and support for their products less desirable? I don't follow.

      Do you drink wine or beer? The top quality products of beer and wine are in

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        No don't you see? He's saying that he would rather just always drink Budweiser, where he knows he's got the programming of decades of advertising, and a multibillion dollar ongoing marketing campaign to brainwash him into loving it more than any other beer, without even having to go to the trouble of tasting it (which probably wouldn't work out for the best anyway)

      • If for example, Samsung and LG make decent Android devices and provide support for them, you could buy from them and get a decent consistant Android device and support.

        If that were the case, you'd be safe. I don't know of a manufacturer that consistently provides bug-free devices and support for them for, say, 2 years back.

        You are generally safe with Nexus devices, since you have the best chance of upgrading to the latest OS. This helps with vulnerabilities which won't be fixed in older versions of Android [arstechnica.com]. But because Nexus devices shuffle between different manufacturers, you lack consistency from a hardware standpoint.

        • If that were the case, you'd be safe. I don't know of a manufacturer that consistently provides bug-free devices and support for them for, say, 2 years back.

          I don't know of any manufacturer, Apple included, that consistently provides bug-free devices. But if 2 years of updates is your benchmark, Samsung meets it. They have Android Lollipop (5.0.1) running on their Galaxy S4 (released April 29, 2013, so it's just over 2 years old). Granted, 5.1.1 is the true latest and greatest Android version, but it was only released on April 21, 2015, so it's a unrealistic to expect Samsung to push that out to a 2 year old device so quickly.

          • The Samsung Galaxy S4 is a single handset among many that they offer. My Wife as the Samsung Galaxy Core LTE [gsmarena.com], which is much newer than the S4 (November 2014) and still doesn't have an update to Lollipop. So, while some handsets from some manufacturers get updates, I haven't seen an Android handset manufacturer that updates all their devices in a timely manner for 2 years.

            • Well, I guess it's flagships only or something. I dunno. Looks like the Galaxy Core LTE hasn't been out long, so maybe that's why? I wouldn't even want to speculate.

        • by ncc74656 ( 45571 ) *

          You are generally safe with Nexus devices, since you have the best chance of upgrading to the latest OS.

          A device with an unlocked bootloader is also more likely to be more future-proof. I have a newer version of KitKat running on my Galaxy Tab 2 7.0 (4.4.4) than on my considerably newer Moto X (4.4). The tablet's running Cyanogenmod...have no idea if Samsung ever got around to spinning a KitKat build for it, and don't particularly care at this point as the only thing that doesn't work under Cyanogenmod

    • There's nothing wrong with that, but it doesn't really apply to everyone. And the cost of data security is dimissively low. For the typical Android handset, the simple blow of a hammer instead of trying to recover less than $100 on ebay or craigslist will guarantee security of your old data. Heck, that $100 is less than the differential between an android handset and an equivalent iOS device in most cases.

    • My lenovo laptop runs Ubuntu Linux. I like to make my own choices.
    • Similarly here. Except I switched to Windows Phone. Apple phones, while well supported and good quality, are just a little too pricey for me. Samsung and LG are not without their faults either. Maybe on a few select flagship phones they have updates but the majority of their handsets have just as few updates as all the other manufacturers. My previous LG phone was released 6 months before Android 4 came out, and I never saw a single software update to that phone, so I was stuck with Android 2.3

      On a side

    • See, this is why I'm a convert to Apple iOS. Yes, there are a few reputable hardware vendors for Android like Samsung and LG; and in many cases, superior hardware specs for the latest device. The problem is the hardware/software permutation and lack of post-sales support and upgrades. THIS is why I abhor the Android platform.

      I get your point about lack of post-sales support and upgrades. However, I don't understand how hardware/software permutation is a problem. You only need one good device. Why would I care if a cheap device I didn't buy from one of these chinese vendors is buggy and lacks support?

      • Application experience can vary widely between the different phones, OS, and UI version combinations. It's ultimately up to the developer to iron out the kinks, but can be such a PITA that depending on user-base, "good enough" is all that's needed. In some cases, it's just plain crappy.

        I found iOS app experience to be at least consistent and more polished. I'm not sure it's so much of the OS as it is lack of Apple models and iOS versions to test against. That, and Apple is picky on who and what gets publish

    • by Holi ( 250190 )
      I don't know, I've wiped a few iPhones to find my pictures still on them. Was on of the reasons I left Apple.
  • Affects Android 2.3, aka Gingerbread. Does anyone even use Gingerbread anymore? Ice Cream Sandwich was released in 2011.
    • Affects Android 2.3, aka Gingerbread. Does anyone even use Gingerbread anymore?

      Yes.

    • You are unaware that a lot of cheapo phones, currently on the market, especially those for 3rd world countries, run 2.3?

  • Bad news: formatting your hard drive or reinstalling your OS (any consumer OS) doesn't, by default, actually erase your data either.

    Why are we surprised?

    • Bad news: formatting your hard drive or reinstalling your OS (any consumer OS) doesn't, by default, actually erase your data either.

      Why are we surprised?

      But we do have options. The fact that people are willing to store so much personal data on their smartphones is just showing us how dumb they are. Why would they not think a factory reset wouldn't wipe their data. If the thought even crossed their mind.

      If they even thought to do a factory reset in the first place.

      And this incrypton thing, sounds like a lot of work - Swamp people is on, and I can't miss that! Many of us are doing well to get our shoes tied in the morning.

      • Bad news: formatting your hard drive or reinstalling your OS (any consumer OS) doesn't, by default, actually erase your data either.

        Why are we surprised?

        But we do have options. The fact that people are willing to store so much personal data on their smartphones is just showing us how dumb they are. Why would they not think a factory reset wouldn't wipe their data. If the thought even crossed their mind.

        Probably because of the pop up that says all your information will be wiped?

        • Probably because of the pop up that says all your information will be wiped?

          All you have to do is believe it.

          Best secure wipe is 25 pounds of thermite. It does void the warranty however.

  • That's why products like Cerberus can tell you where the scumbag who nicked your phone is, even if said scumbag deletes apps and data via factory reset.

  • I wouldn't expect it to "wipe storage", nor would I want it to. Flash storage has a limited number of write cycles, and people do factory resets much more frequently during the lifetime of a product than wiping the device in order to recycle it. If you want to erase storage, use the "erase storage" function.

  • I did a wipe/reset on my samsung before, I was surprised it still had the pictures, downloads and some bits of old apps in various folders. But I can see why, Im sure some people do unnecessary resets when they think something is wrong with their phone and they dont want to deal with people complaining they lost all their important photos. That they never backed up of course.
  • by Anonymous Coward

    Anti-virus company Avast! bought a bunch of phones and published their findings last year on the same subject

    http://yro.slashdot.org/story/14/07/09/0034244/avast-buys-20-used-phones-recovers-40000-deleted-photos

  • Internal SD cards aren't fully wiped during a reset. Why not just pull the card, put it in a computer card reader, format and then do an advanced wipe (I use ccleaner for wipes)? That's what I plan to do when I need to factory reset my phone. Prior to reading this I wouldn't have pulled the SD card before a reset. Now I will. Thanks for the tip.
  • I bought a cheap tablet for 35 AUD from officeworks. The normal price was 45 AUD but this device was pink (for kids) and had been returned. I took it home, and when I experimented with the gallery I found selfies taken by a child. I ran the factory reset but the pictures were still there so I just deleted the photos.

You see but you do not observe. Sir Arthur Conan Doyle, in "The Memoirs of Sherlock Holmes"

Working...